PCNSA Threat Prevention Flashcards

What is the recommended WildFire file blocking action for unknown files in a high-security environment?

Answer: Forward for analysis

Forwarding unknown files to WildFire for analysis allows the firewall to receive a verdict and take appropriate action.

Which profile type must be attached to a security policy rule for threat prevention to be enforced?

Answer: Security profile

Security profiles (Antivirus, Anti-Spyware, Vulnerability Protection, etc.) must be attached to security policy rules to enforce threat inspection.

What does the 'reset-both' action do in a Palo Alto Networks threat prevention profile?

Answer: Sends TCP reset to both the client and the server

The reset-both action terminates the TCP connection by sending a TCP RST to both the client and the server simultaneously.

In Palo Alto Networks, what is a 'Security Profile Group' used for?

Answer: Combining multiple security profiles into a single object for easy policy assignment

A Security Profile Group bundles multiple individual profiles (Antivirus, Anti-Spyware, etc.) so they can be applied to policy rules as a single object.

Which threat severity level in Palo Alto Networks indicates the highest risk and requires immediate attention?

Answer: Critical

Critical severity indicates the most serious threats, such as those that could allow full system compromise or remote code execution.

What is the primary function of Zone Protection profiles on a Palo Alto Networks firewall?

Answer: Protecting zones from flood, reconnaissance, and packet-based attacks

Zone Protection profiles defend network zones against DoS floods, port scans, and malformed packet attacks at the zone ingress.